Steam’s Australian Age Gate Accepts Credit Cards Only

Australian Steam users now need a valid credit card on file to open R18+ store pages, after Valve switched the check on 9 September. Debit cards and PayPal do not qualify, and a 20-year-old account does not help.

The on-screen notice cites the Age-Restricted Material App Distribution Services Code. PlayStation, Xbox and Epic, facing the same rule, each offered more than one way to prove you are 18. Steam offered one, and it is the payment product young adults are least likely to hold.

A Credit Card Gate on R18+ Store Pages

The lock is not only on checkout. Open an R18+ listing, or its community hub, without a qualifying card and Steam stops you at a legal warning. Titles already in a library, including Cyberpunk 2077, have gone dark at the store layer for some accounts.

THE STEAM MESSAGE

Valve is required by the Age-Restricted Material App Distribution Services Code to verify that you are 18 or older before accessing mature content. If you wish to do so, please add a valid Australian credit card to your account and afterwards update the Mature Content Preferences.

Valve, in-client notice, Steam Australia

The card has to stay on the account. In the UK, where Valve first used this method, an account stays age-checked only while a valid credit card remains stored. Australian users are hitting the same reset when they pull the card off, which means a one-time auth is not enough if you do not want Steam keeping the number.

Some Mastercard debit products from large banks have gone through. Others have not. PayPal, which itself requires an adult account, has not. The pattern is messy enough that people are testing ZIP Pay cards and $1-limit virtual numbers so Steam keeps a token without a revolving line of credit.

The Age-Check Deadline Was 9 September

The codes were not a surprise drop. eSafety registered the six remaining Age-Restricted Material Codes, including the app-store schedule, on 9 September 2025. Those codes started on 9 March 2026. Age checks for people downloading R18+ apps had a further six months.

eSafety’s own FAQ says services must have age checks for R18+ apps by 9 September 2026. That is the date Steam, and Epic, turned the gate on. Xbox had already begun late in August. PlayStation had been emailing Australian adult accounts from 20 August.

The codes were drafted by industry groups and then registered, so they are mandatory. They cover app stores, search, social apps, hosting, carriage, devices and other online services. For games, the test is the National Classification Scheme: R18+ needs an age check, lower ratings do not.

eSafety is explicit about the other side of the bargain. The codes are there to keep under-18s off high-impact material, and they are also there to leave adults able to reach lawful content. A fact sheet on the package says the codes do not stop adults from accessing legal but age-restricted material, and that no single check is required.

CHECKS ESAFETY LISTS AS APPROPRIATE

• Photo ID match: A scan of a passport, licence or other accepted document.
• Facial age estimate: A camera check that guesses an age range from a face.
• Credit card checks: The path Valve chose, because issuers must confirm an applicant is 18.
• Digital identity wallets: Systems such as ConnectID, which Epic has said it will add.
• Parent confirmation: A guardian attesting to a user’s age.
• Other AI estimates: Models that use allowed data inputs rather than a live selfie.

Whatever method a service picks, eSafety says it must cut the personal data it collects and still meet the Privacy Act. That privacy brief is the opening Valve used. It is also how a legal adult with a debit card, a driver’s licence and a decade of Steam purchases can still be treated as unverified.

Why Steam Copied Its UK Credit Card Check

On 29 August 2025 Valve put the same gate on UK mature store pages and hubs, to meet the Online Safety Act. Its support note, still live, walks through a card form, a bank challenge, and a test authorisation that shows as a £1 hold Steam does not keep. Debit is out, the note says, because debit can be issued to minors.

Valve’s privacy case is written in that UK FAQ, and it is the best public explanation of what Australian users are now being asked to do.

Among all age assurance mechanisms reviewed by Valve, this process preserves the maximum degree of user privacy. The data processed in the verification process is identical to that of the millions of other Steam users who make purchases or store their payment details for convenience. The verification process therefore provides no information about a user’s content preferences to payment providers or other third parties.

Valve, Steam Support, Age Assurance under the UK Online Safety Act

The UK write-up also says keeping the card on file is a deterrent against sharing one adult account around a household. Ofcom had listed credit-card checks as a highly effective measure there. Australia’s code lists them as one option among several. Valve’s Australian notice still points at the App Distribution Services Code, then offers only the UK method.

The company has not published an Australia-specific FAQ that matches the UK page. The closest on-record line from Steam Support, sent to users asking about PayPal, is that credit-card ownership is the only path it currently offers, that the process is new, and that pain points are being collected. The UK FAQ still says the process preserves the maximum degree of user privacy, which is the trade Australian adults are being asked to accept without a face scan or an ID upload as a fallback.

16.5 Million Credit Cards, 50.7 Million Debit

A credit card is a weak proxy for adulthood in this market because it is not how most adults pay. The Reserve Bank’s May 2026 retail payments release counted 16.5 million credit and charge cards on issue, against 50.7 million debit cards.

In that same month Australians made 1,069.1 million debit purchases and 336.7 million credit and charge purchases. Debit ran $59.0 billion; credit and charge ran $40.7 billion. The RBA’s 2025 Consumer Payments Survey, published in the May 2026 Bulletin, found debit cards were 49% of consumer payments, credit and charge cards 23%, and cash 15%. People aged 18 to 29 put about 80% of payments on cards, and the mix in that group is debit-heavy.

ASIC’s Moneysmart Gen Z survey, run by YouGov in November and December 2025 among people aged 18 to 28, puts a number on the gap Valve is now using as a lock.

HOW AUSTRALIANS ACTUALLY PAY

So 43% of Gen Z hold a credit card, up from 25% in 2023, while 58% of older adults do. Among that younger group, 46% of men and 39% of women have one. A 15-point gap remains between the newly adult cohort the R18+ rating is written for and everyone else.

Banks in this country also tell mortgage applicants to cut credit-card limits, or close the cards, before a home-loan sign-off. Adults in that position are being asked to re-open a product they were advised to drop, just to read a store page. That is the quiet second lock: the check trusts a credit relationship many households have spent years unwinding.

PlayStation, Xbox and Epic Opened Other Doors

Sony, Microsoft and Epic had the same 9 September app-store deadline, and each put more than one check in front of Australian adults. None of them made a revolving credit line the only key.

PlayStation’s Australian support page lets an adult pick a facial scan or a photo of an ID. Yoti runs both. Sony says it never sees the face geometry, and that Yoti deletes it when the check finishes. An ID scan can take three to six minutes and may add a liveness selfie. You verify once per account. Games already in the library still play if you skip it; you just cannot add new R18+ items from PlayStation Store until you pass.

Xbox began in late August with a notice that adult accounts must verify to reach 18+ apps and games on the Xbox Store and the Microsoft Store on PC. Owned games stay playable. The methods Microsoft listed in that rollout were email-based confirmation, a facial age estimate, a credit card, and a government ID. Partners named in the same notices included Yoti and VerifyMy.

Epic turned its gate on 9 September for R18+ downloads and purchases, leaving owned games and lower ratings alone. The checks run through Kids Web Services. The opening set is a Yoti selfie, a Stripe card authorisation of five cents, and a Veriff document scan, with ConnectID, the bank-backed digital identity exchange, due later in September.

AGE CHECKS ON EACH STORE

Steam is the outlier twice. It is the only major store that will not take a face or an ID, and it is the only one that treats the payment method as a standing proof rather than a one-time pass. The privacy gain is real: Valve never sends a selfie to a vendor, and the card data sits in the same PCI-DSS system it already uses for purchases. The cost of that choice is that adulthood on Steam now tracks credit-card issuance, not age.

Dark Store Pages for Games Already Owned

The practical harm is wider than a blocked checkout. Users who already paid for an R18+ game still need the card to open that game’s store page and hub, which is where patches, discussions and news live. That is a different design from Xbox and PlayStation, which left owned copies playable and only gated new additions.

WHAT THE LOCK ACTUALLY BLOCKS

• Store listings: The product page for an R18+ title will not load until the card is on file and mature-content preferences are updated.
• Community hubs: The same gate sits on discussions, so a verified purchase does not restore the hub.
• Old accounts: A Steam profile that predates the user’s 18th birthday by years is still unverified.
• Debit and PayPal: Official path is a credit card; stray debit successes look like a bank-BIN accident, not a policy.
• A standing credential: Remove the card and the adult flag drops, which is the UK rule transplanted.

Workarounds now circulating treat the gate as a payments problem, because that is the only lever Valve left in reach. ZIP Pay cards have passed for some people because they behave like credit. Virtual card numbers with a tiny spend cap have been used to survive the authorisation, then sit on the account as a husk. Those tricks help only the people who can already open some kind of credit product. They do nothing for an 18-year-old with a debit card, or for a 40-year-old who closed every card for a home loan.

The refund question follows from the store-page lock. If a paid-for hub is unreachable, users are already asking Steam Support whether the purchase still delivers what was sold. Valve has not posted a public refund policy tied to the Australian check.

Steam Support Calls Credit Cards the Only Path

Steam Support has told users that, for now, credit-card ownership is the only path it offers under the App Distribution Services Code, and that it is still gathering data on pain points. Valve has not said it will add a face estimate, an ID scan or ConnectID. It has not said the debit lottery is intended.

WHAT WE KNOW

• The deadline: App-store age checks for R18+ downloads had to be in place by 9 September 2026.
• Steam’s method: An Australian credit card, left on the account, then a mature-content preference update.
• The code’s menu: eSafety lists ID, face estimates, cards, digital wallets, parent confirmation and other AI estimates as available tools.
• The payment mix: Debit cards outnumber credit and charge cards by more than three to one on issue, and they carry 49% of consumer payments.

WHAT IS UNCONFIRMED

• Debit by design: Whether any debit BIN is meant to pass, or whether those successes are errors.
• A second method: Whether Valve will copy Epic or PlayStation and add a non-card check.
• Owned-game pages: Whether hiding store pages of games already bought is a bug or the intended UK-style hub lock.

ConnectID is still scheduled to join Epic’s set later in September, which will give that store a bank-backed identity check that is not a revolving credit line. Steam’s Australian adults remain on the UK template: prove you can borrow, or do not open the page.